karagenit

I think in this case, the Tizen OS (by Samsung) on these TVs has a developer mode where you can use their Samsung Debug Bridge CLI tool on another computer to connect to the TV and get a regular Linux user shell. From there, they found a local privilege escalation bug to get root. I don’t know the exact details but a lot of smart devices get poor security support, so you can just shotgun different known vulnerabilities and get lucky with one pretty often rather than needing to develop a novel one.

Everything becomes a programming language in due time. At work we have YAML files with #if and #include statements…

Yeah, except in total there were eight different weak keys, all less than 256. The odds of randomly generating those keys (all so small) is so astronomically low that we know for sure their keygen process was messed up.

Yeah, this doc is really interesting. It has some absolutely claude-fried lines like:

> A hook is Koa-style middleware: it reifies an endomorphic continuation

> Five forms, each on tool.call;

But on the other hand uses distinctly human phrases like “one may” and “etc./e.g.” that I rarely see LLMs use. Not sure what to think.

The bug was from 2009, so probably not :)

Way off topic, but free climbers definitely do use carabiners. Free here means “free from aid” i.e. not using ladders or other tools common in aid climbing, but free climbing still includes safety devices to catch a fall (usually involving carabiners). You’re thinking of free soloing which also excludes safety devices. And yea, these terms are confusing, I guess naming things is hard!

I’m sorry you’re feeling ganged up on, I thought it was a nice article and cool you were able to repro the bug with your tools.

Like some others have mentioned, one of my earliest thoughts was “how much of a hint was the LLM given about the bug?” I think if the prompt used was stated clearly/verbatim near the beginning of the article, that would probably dispel a good amount of the criticism.

I think your natural writing voice is nice and the project idea is cool. There’s nothing wrong with using LLM coding tools. However, I have to read Claude output all day for my job, and it’s kind of bad at writing. I’ll be damned if I spend any of my free time reading more of it. I would really enjoy reading an article on this project from you directly. And not everyone else uses LLMs for producing technical texts (at work, we’re expected to understand the LLM output and put the correct/important parts in our own words when writing documents).

The employee didn’t have a contract with Apple so it isn’t a contract dispute. These would be statutory causes of action (also civil, but different than contract law) based on the claims in the suit. The plaintiff alleges Apple broke the law, but specifically whistleblower retaliation and disability discrimination statutes, not consumer privacy laws (which is sort of a secondary concern to the whistleblower claim, since those protections can apply even if no law was actually broken).

It’s a cool site and you don’t seem to be spamming. But your account is new and has only posted links to your site (4 times) which probably caught the automated spam detection system. I’d gently encourage you to engage with the community and share some things that aren’t your own work as well. From the guidelines:

> Please don't use HN primarily for promotion. It's ok to post your own stuff part of the time, but the primary use of the site should be for curiosity.

Can I ask how your orgs measured productivity before and after remote work/RTO? I agree that employees would have a much easier time accepting RTO if they were given hard evidence it makes the business more productive, but it seems like almost all companies don’t do this and simply justify RTO “because we know best” which frustrates ICs.

Yep, and following that with

> and Chinese models are poised to take the lead.

makes it sound like the second part is a continuation of the first quote from the same source, but actually the second link is just some random person’s substack post from almost a year ago.

Tangent, but I’m really curious what country you’re from that uses the endonym for Göteborg but then also spells the capital of Denmark like Kopenhagen?

> You will encounter business decisions you think are terrible but you still have to sell to your team. You cannot vent your frustration to the people you lead.

I actually disagree with this point a lot, as an IC. My manager shares his honest opinions with us, and I respect him more for it. It seems like the rest of the team feels the same.

I’ve had managers try to sell <obviously bad thing> as something good for the team, and it sucks. It feels like being gaslit. I think honest, open communication is a much better way to run a team. We’re all adults and professionals too; we can handle the truth.

It seems like based on e.g. [1] the article originally made some stronger claims about “no difference in bugs” that have been corrected. I agree that now it seems fine, but those edits might be why it feels like some commenters read a different article than you.

[1]: https://news.ycombinator.com/item?id=48418186

True, but the article also says:

> That's it. No rate limiting. No account lockout.

To me, if he confirmed that there’s no rate limiting on the auth API, this implies a scripted approach checking at least tens (if not more) of accounts in rapid succession.

I would highly recommend giving this excelled LessWrong post a read: https://www.lesswrong.com/posts/rarcxjGp47dcHftCP/your-llm-a...

It isn't a perfect fit, since the article talks a lot about the scientific method which doesn't apply super well to philosophy+math, but I think there are some strong parallels here.

Looks cool! Does it support prompt caching? And do you have any data showing how your latency compares to going directly to the model providers? I’m thinking about trying it out but those are my two big reservations.

What if the number of game critics just hasn’t increased, and since they can only play/review a fixed number of games each year due to time constraints, the number that they acclaim each year hasn’t grown? Not saying this is necessarily the case, just suggesting the possibility.

Yeah, I'd probably go that route if I wanted to scrape more than the handful of pages I needed for this project. I wonder if it would work on Zillow or not. Even my simple workflow of "click the next button, save the request in devtools, repeat" was suspicious enough to trigger a captcha-type "are you a bot?" challenge. Maybe it was just too many requests quickly like you mentioned, or maybe they're doing something more advanced like mouse movement tracking.